Malicious PDF — malware analysis report

Static analysis result for SHA-256 54db4cf96d4323f6…

MALICIOUS

PDF

75.8 KB Created: 2021-03-07 02:39:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: b82771988e001e24c25faa9a64e99521 SHA-1: 36a46d68a04c6009746e305946ba3d6515c7038e SHA-256: 54db4cf96d4323f63a9d755923f7952b20464bd3100378f56a4d02895b0be7ef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://midufefew.ru/strik?utm_term=baby+got+back+song+youtube` is the primary indicator of compromise, likely serving as a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to a popular song, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=baby+got+back+song+youtube PDF link annotation
    • http://dfwshootersupply.com/bass_pro_shops_duck_shooting_target_gameoe754.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450158/normal_5ff95da5ce350.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479705/normal_600337d53db31.pdfIn PDF document text
    • http://sellamorem.com/nonefibadejuru28lic.pdfIn PDF document text
    • http://arthromedro.xyz/72130899468lrtzm.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374207/normal_5fdffe8fba3b5.pdfIn PDF document text
    • http://gratoraama.website/telugu_movies_hd_mobilexbgr2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412592/normal_6020d406e5ce2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444098/normal_5fffdb347e66f.pdfIn PDF document text
    • http://busibear.com/47449494963i7svy.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bd739ba-e138-45e1-ba8a-cff8bd39e4f9/linux_beginners_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xujitezu/tuwojuvafe.pdfIn PDF document text
    • https://s3.amazonaws.com/wupiwupiwot/navy_seal_training_guide_mental_toughness_lars_draeger.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b59c748-0c60-4b86-8f80-91421cfcea3f/harry_potter_book_1_barnes_and_noble.pdfIn PDF document text
    • https://s3.amazonaws.com/fezenur/asus_android_usb_driver_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/guwutivupudutu/tuposigorufunabunorukomo.pdfIn PDF document text
    • http://bepolujogox.atwebpages.com/thermo_king_apu_memphis_tn.pdfIn PDF document text
    • https://s3.amazonaws.com/tisegovofu/aspects_of_globalization.pdfIn PDF document text
    • https://s3.amazonaws.com/xebuvuwov/child_cartoon_songs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e843e44c-b582-43c0-8d42-2f0a6a21b033/kingdom_of_dreams_book_tickets.pdfIn PDF document text
    • http://pabewuvuxaf.onlinewebshop.net/which_instant_water_heater_is_best_in_singapore.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9615172e-5b4b-4fa5-8db2-94c768a40e6b/60981812251.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eba4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA4 5192 bytes
SHA-256: 1fe5a9f420e94f013550251f2ef7b2bd60e672cf94d4a3856ed4ed2796805554
font_01_sfnt_off0000fd77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD77 10792 bytes
SHA-256: d020aa38562e6080786dcfd039016462b62a3ab81fae8d872311381dddbee82b

Open this report in the interactive analyzer, or submit your own file for analysis.